CVE-2026-56357: n8n GitHub Webhook Signature Forgery Vulnerability

Technical summary

The GitHub Webhook Trigger node in n8n versions before 1.123.15 and 2.5.0 fails to implement HMAC-SHA256 signature verification on incoming webhook POST requests. GitHub's standard webhook security model relies on computing an HMAC-SHA256 hash of the request body using a shared secret, then comparing it to the X-Hub-Signature-256 header. When this verification is absent, any attacker who discovers or guesses the webhook URL can send arbitrary JSON payloads to trigger workflows, simulating legitimate GitHub events. The vulnerability is classified as CWE-290 (Authentication using a Secondary Channel), reflecting the absence of cryptographic proof that requests originate from GitHub.

Business impact

Workflows relying on GitHub Webhook Trigger nodes become subject to external manipulation without authentication. An attacker could trigger CI/CD jobs, execute automation scripts, modify repositories, or invoke downstream systems via forged webhook events. In organizations using n8n for critical deployment or security-related automation, this could lead to unauthorized code deployments, data manipulation, or lateral movement into connected systems. The impact depends heavily on what actions the triggered workflows perform and what permissions they hold in connected services.

Affected systems

n8n instances running versions before 1.123.15 (in the 1.x branch) or 2.5.0 (in the 2.x branch) are affected. Any workflow that uses the GitHub Webhook Trigger node is vulnerable to forgery. The vulnerability is present in both self-hosted and cloud-hosted n8n deployments.

Exploitability

Exploitability requires discovery of the webhook URL, which may be enumerated through GitHub repository settings inspection (if the attacker has repository access), accidental exposure in logs, or brute-force attempts. Once the URL is known, generating forged requests requires no special tools or authentication—a simple HTTP POST with crafted JSON is sufficient. The CVSS vector (AV:N/AC:H) reflects that while the attack is network-accessible, the requirement to know or guess a specific URL introduces moderate complexity. Weaponized proof-of-concept tools are not known to be circulating, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.

Remediation

Upgrade n8n to version 1.123.15 or later (1.x branch) or 2.5.0 or later (2.x branch). These versions implement proper HMAC-SHA256 signature verification on GitHub Webhook Trigger nodes. After patching, verify that your GitHub webhook configuration includes the shared secret, and confirm that your webhook trigger nodes are validating signatures correctly.

Patch guidance

Review your n8n deployment's current version and branch. If running 1.x versions, update to 1.123.15 or later; if running 2.x, update to 2.5.0 or later. Refer to the n8n release notes and installation documentation for your specific deployment method (Docker, npm, cloud-hosted console). After applying the patch, test the GitHub Webhook Trigger node with a test event from GitHub to confirm signature validation is functioning. Organizations on SaaS versions should check whether your instance has been automatically updated; if not, contact n8n support for deployment details.

Detection guidance

Monitor n8n audit logs for POST requests to GitHub Webhook Trigger nodes that lack or fail signature validation. Examine the X-Hub-Signature-256 header in webhook request logs—legitimate GitHub events will always include this header. Look for webhook requests with unusual or unexpected payloads that do not match your expected GitHub event patterns (e.g., unexpected repository names, user accounts, or event types). If n8n provides webhook request logging or inspection tools, enable them for any GitHub Webhook Trigger nodes used in production workflows. Network-level detection is difficult without endpoint logging, as the traffic is HTTPS.

Why prioritize this

While the CVSS score is MEDIUM (4.0), prioritization depends on two factors: (1) whether your workflows use GitHub Webhook Trigger nodes, and (2) what downstream actions those workflows perform. If you use GitHub webhooks only to trigger low-sensitivity notifications or logging, priority is lower. If webhooks trigger code deployments, secret retrieval, or access to production infrastructure, this should be patched urgently. The absence of KEV status and active exploitation does not eliminate risk in high-impact automation scenarios.

Risk score, explained

The CVSS 3.1 score of 4.0 (MEDIUM) reflects several mitigating factors: no confidentiality impact (C:N), limited integrity impact (I:L), no availability impact (A:N), and the requirement to know the webhook URL (AC:H). The integrity impact is rated low because the attacker can forge event data but cannot directly alter n8n's configuration or other systems without the downstream workflow's cooperation. However, the scope is changed (S:C), meaning the impact extends beyond the vulnerable component to whatever systems those workflows can access. Organizations should evaluate their specific risk based on workflow permissions and integration points rather than relying solely on the base CVSS score.

Frequently asked questions